UserAgent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Steps to reproduce the problem:
1.Replace the "C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Safe Browsing Bloom Prefix Set" with the PoC file.
2.Trun to Safe browsing mode in Chrome.

What is the expected behavior?
The Browser Process(main process) of Chrome will crash.
The Chrome app can not be reopened.

What went wrong?
When go to Safe browsing mode,Chrome will call PrefixSet::LoadFile function in src/components/safe_browsing_db/prefix_set.cc.

ref:https://cs.chromium.org/chromium/src/components/safe_browsing_db/prefix_set.cc?q=src/components/safe_browsing_db/prefix_set.cc+package:%5Echromium$ACTUALl=164

In PrefixSet::LoadFile, it will open "Safe Browsing Bloom Prefix Set" file, then read something.
First, read Header:
  177 FileHeader header;
  178 size_t read = fread(&header, sizeof(header), 1, file.get());

Then compute index_bytes, deltas_bytes, full_hashes_bytes:
  200 IndexVector index;
  201 const size_t index_bytes = sizeof(index[0]) * header.index_size;

  203 std::vector<uint16_t> deltas;
  204 const size_t deltas_bytes = sizeof(deltas[0]) * header.deltas_size; 

  206 std::vector<SBFullHash> full_hashes;
  207 const size_t full_hashes_bytes =
      sizeof(full_hashes[0]) * header.full_hashes_size;

Then compute expected_bytes, and do saint check to avoid overflow:
  210 // Check for bogus sizes before allocating any space.
  211 const size_t expected_bytes = sizeof(header) +
  212    index_bytes + deltas_bytes + full_hashes_bytes + sizeof(MD5Digest);
  213 if (static_cast<int64_t>(expected_bytes) != size_64)
  214    return nullptr;

But the check is invalid on 32-bits platform, because expected_bytes with type size_t is 32 bits, it will also overflow when index_bytes, deltas_bytes or full_hashes_bytes is large enough. And the index_bytes, deltas_bytes or full_hashes_bytes is computed with value from "Safe Browsing Bloom Prefix Set" file.

By bypassing the integer overflow, the program can go on, leading to crash, such as:
  220 index.resize(header.index_size);

  231 deltas.resize(header.deltas_size);

  242 full_hashes.resize(header.full_hashes_size);

Patch:
  To avoid the cash, just modify "const size_t expected_bytes" to "const int64_t expected_bytes".

Did this work before? N/A 

Chrome version: 56.0.2924.87  Channel: stable
OS Version: 6.1 (Windows 7, Windows Server 2008 R2)
Flash Version:

 

Deleted: PoC 3.3 MB

PoC 3.3 MB View Download